관리 가이드 Red Hat Virtualization 4.4

hostname

# vim /usr/share/ovirt-engine/playbooks/change-spice-cipher.yml
name: oVirt - setup weaker SPICE encryption for old clients
hosts: hostname
vars:
  host_deploy_spice_cipher_string: 'DEFAULT:-RC4:-3DES:-DES'
roles:
  - ovirt-host-deploy-spice-encryption
# ansible-playbook -l hostname /usr/share/ovirt-engine/playbooks/change-spice-cipher.yml
# ansible-playbook -l hostname \
  --extra-vars host_deploy_spice_cipher_string=”DEFAULT:-RC4:-3DES:-DES” \
  /usr/share/ovirt-engine/playbooks/ovirt-host-deploy.yml
# engine-config -s MaxAverageNetworkQoSValue=2048
# systemctl restart ovirt-engine
# engine-config -s MaxAverageNetworkQoSValue=2048
# systemctl restart ovirt-engine
protocol://[host]:[port]
routes:
  config:
  - destination: 192.168.123.0/24
    next-hop-address: 192.168.178.1
    next-hop-interface: eth1
$ nmstatectl set static_route.yml
$ ip route | grep 192.168.123.0`
routes:
  config:
  - destination: 192.168.123.0/24
    next-hop-address: 192.168.178.
    next-hop-interface: eth1
    state: absent
interfaces: [{“name”: eth1}]
$ nmstatectl set static_route.yml
$ ip route | grep 192.168.123.0`
# dnf update nmstate
# systemctl restart vdsmd supervdsmd
# dnf update NetworkManager
# systemctl restart NetworkManager
forward_delay=1500
group_addr=1:80:c2:0:0:0
group_fwd_mask=0x0
hash_max=512
hello_time=200
max_age=2000
multicast_last_member_count=2
multicast_last_member_interval=100
multicast_membership_interval=26000
multicast_querier=0
multicast_querier_interval=25500
multicast_query_interval=13000
multicast_query_response_interval=1000
multicast_query_use_ifaddr=0
multicast_router=1
multicast_snooping=1
multicast_startup_query_count=2
multicast_startup_query_interval=3125
--coalesce em1 rx-usecs 14 sample-interval 3 --offload em2 rx on lro on tso off --change em1 speed 1000 duplex half
--coalesce * rx-usecs 14 sample-interval 3
# engine-config --set SetupNetworksWaitTimeoutSeconds=40
Changing certain properties (e.g. VLAN, MTU) of the management network could lead to loss of connectivity to hosts in the data center, if its underlying network infrastructure isn't configured to accommodate the changes. Are you sure you want to proceed?
# dnf install vdsm-hook-extra-ipv4-addrs
# engine-config -s 'UserDefinedNetworkCustomProperties=ipv4_addrs=.*'
# systemctl restart ovirt-engine.service
# systemctl enable --now ovirt-lldp-labeler
# /usr/bin/python /usr/share/ovirt-lldp-labeler/ovirt_lldp_labeler_cli.py
# hostnamectl set-hostname NEW_FQDN
  ----
  <interface type='hostdev'>
     <mac address='00:1a:yy:xx:vv:xx'/>
     <driver name='vfio'/>
     <source>
       <address type='pci' domain='0x0000' bus='0x05' slot='0x10' function='0x0'/>
     </source>
     <alias name='ua-18400536-5688-4477-8471-be720e9efc68'/>
     <address type='pci' domain='0x0000' bus='0x00' slot='0x08' function='0x0'/>
   </interface>
   ----
# ip -s link show dev enp5s0f0

1: enp5s0f0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP mode DEFAULT qlen 1000
    link/ether 86:e2:ba:c2:50:f0 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped overrun mcast
    30931671   218401   0       0       0       19165434
    TX: bytes  packets  errors  dropped carrier collsns
    997136     13661    0       0       0       0
    vf 0 MAC 02:00:00:00:00:01, spoof checking on, link-state auto, trust off, query_rss off
    vf 1 MAC 00:1a:4b:16:01:5e, spoof checking on, link-state auto, trust off, query_rss off
    vf 2 MAC 02:00:00:00:00:01, spoof checking on, link-state auto, trust off, query_rss off
# systemctl enable --now ovirt-lldp-labeler
# /usr/bin/python /usr/share/ovirt-lldp-labeler/ovirt_lldp_labeler_cli.py
# cat /proc/net/bonding/bond0
# vi /etc/default/grub
...
GRUB_CMDLINE_LINUX="nofb splash=quiet console=tty0 ... intel_iommu=on
...
# vi /etc/default/grub
…
GRUB_CMDLINE_LINUX="nofb splash=quiet console=tty0 … amd_iommu=on
…
# vi /etc/modprobe.d
options vfio_iommu_type1 allow_unsafe_interrupts=1
# grub2-mkconfig -o /boot/grub2/grub.cfg
# reboot
# dnf install vdsm-hook-nestedvt
$ cat /sys/module/kvm*/parameters/nested
$ cat /sys/module/kvm*/parameters/nested
# vi /etc/ovirt-engine/ansible/ovirt-host-deploy-post-tasks.yml.example
---
#
# Any additional tasks required to be executing during host deploy process can
# be added below
#
- name: Enable additional port on firewalld
  firewalld:
    port: "12345/tcp"
    permanent: yes
    immediate: yes
    state: enabled
# subscription-manager repos --enable=rhvh-4-for-rhel-8-x86_64-rpms
# subscription-manager repos \
    --enable=rhel-8-for-x86_64-baseos-eus-rpms \
    --enable=rhel-8-for-x86_64-appstream-eus-rpms \
    --enable=rhv-4-mgmt-agent-for-rhel-8-x86_64-rpms \
    --enable=advanced-virt-for-rhel-8-x86_64-rpms \
    --enable=fast-datapath-for-rhel-8-x86_64-rpms

# subscription-manager release --set=8.6
# subscription-manager repos --enable=rhvh-4-for-rhel-8-x86_64-rpms
# subscription-manager repos \
    --enable=rhel-8-for-x86_64-baseos-eus-rpms \
    --enable=rhel-8-for-x86_64-appstream-eus-rpms \
    --enable=rhv-4-mgmt-agent-for-rhel-8-x86_64-rpms \
    --enable=advanced-virt-for-rhel-8-x86_64-rpms \
    --enable=fast-datapath-for-rhel-8-x86_64-rpms

# subscription-manager release --set=8.6
# cat /etc/redhat-release
# dnf --refresh info --available redhat-release
Available Packages
Name         : redhat-release
Version      : 8.3
Release      : 1.0.el8
…
# dnf module reset virt
# dnf module list virt
# dnf module enable virt:8.2
# dnf module enable virt:8.3
# dnf module enable virt:av
# dnf module enable virt:rhel
# dnf module -y enable nodejs:14
# dnf upgrade --nobest
# vim /usr/share/ovirt-engine/playbooks/change-spice-cipher.yml
name: oVirt - setup weaker SPICE encryption for old clients
hosts: hostname
vars:
  host_deploy_spice_cipher_string: 'DEFAULT:-RC4:-3DES:-DES'
roles:
  - ovirt-host-deploy-spice-encryption
# ansible-playbook -l hostname /usr/share/ovirt-engine/playbooks/change-spice-cipher.yml
# ansible-playbook -l hostname \
  --extra-vars host_deploy_spice_cipher_string=”DEFAULT:-RC4:-3DES:-DES” \
  /usr/share/ovirt-engine/playbooks/ovirt-host-deploy.yml
engine-config -s FenceKdumpDestinationAddress=A.B.C.D
# systemctl restart ovirt-fence-kdump-listener.service
# engine-config -g OPTION
# engine-config -s OPTION=value
# systemctl restart ovirt-engine.service
# engine-config --set ServerRebootTimeout=integer
# dnf install nfs-utils -y
# cat /proc/fs/nfsd/versions
# systemctl enable nfs-server
# systemctl enable rpcbind
# groupadd kvm -g 36
# useradd vdsm -u 36 -g kvm
# mkdir /storage
# chmod 0755 /storage
# chown 36:36 /storage/
# vi /etc/exports
# cat /etc/exports
 /storage *(rw)
# systemctl restart rpcbind
# systemctl restart nfs-server
# exportfs
 /nfs_server/srv
               10.46.11.3/24
 /nfs_server       <world>
# mkdir -p /data/images
# chown 36:36 /data /data/images
# chmod 0755 /data /data/images
# mkdir /data
# lvcreate -L $SIZE rhvh -n data
# mkfs.ext4 /dev/mapper/rhvh-data
# echo "/dev/mapper/rhvh-data /data ext4 defaults,discard 1 2" >> /etc/fstab
# mount /data
# mount -a
# chown 36:36 /data /rhvh-data
# chmod 0755 /data /rhvh-data
# cat /etc/multipath/conf.d/host.conf
multipaths {
    multipath {
        wwid boot_LUN_wwid
        no_path_retry queue
    }
# cat /etc/multipath/conf.d/host.conf
multipaths {
    multipath {
        wwid boot_LUN_wwid
        no_path_retry queue
    }
  }
Physical device initialization failed. Please check that the device is empty and accessible by the host.
[ ERROR ] Error creating Volume Group: Failed to initialize physical device: ("[u'/dev/mapper/000000000000000000000000000000000']",)
[ ERROR ] Failed to execute stage 'Misc configuration': Failed to initialize physical device: ("[u'/dev/mapper/000000000000000000000000000000000']",)
kpartx -dv /dev/mapper/<LUN_ID>
wipefs -a /dev/mapper/<LUN_ID>
 partprobe
# ansible-playbook --extra-vars "lun=<LUN>" /usr/share/ansible/collections/ansible_collections/ovirt/ovirt/roles/remove_stale_lun/examples/remove_stale_lun.yml
# vdsm-tool config-lvm-filter
Analyzing host...
Found these mounted logical volumes on this host:
logical volume:  /dev/mapper/vg0-lv_home
mountpoint:      /home
devices:         /dev/vda2
logical volume:  /dev/mapper/vg0-lv_root
mountpoint:      /
devices:         /dev/vda2
logical volume:  /dev/mapper/vg0-lv_swap
mountpoint:      [SWAP]
devices:         /dev/vda2
This is the recommended LVM filter for this host:
filter = [ "a|^/dev/vda2$|", "r|.*|" ]
This filter will allow LVM to access the local devices used by the
hypervisor, but not shared storage owned by VDSM. If you add a new
device to the volume group, you will need to edit the filter manually.
Configure LVM filter? [yes,NO] ? [NO/yes] yes
Configuration completed successfully!
Please reboot to verify the LVM configuration.
# vdsm-tool config-lvm-filter
Analyzing host...
LVM filter is already configured for Vdsm
# vdsm-tool config-lvm-filter
Analyzing host...
Found these mounted logical volumes on this host:
logical volume:  /dev/mapper/vg0-lv_home
mountpoint:      /home
devices:         /dev/vda2
logical volume:  /dev/mapper/vg0-lv_root
mountpoint:      /
devices:         /dev/vda2
logical volume:  /dev/mapper/vg0-lv_swap
mountpoint:      [SWAP]
devices:         /dev/vda2
This is the recommended LVM filter for this host:
filter = [ "a|^/dev/vda2$|", "r|.*|" ]
This filter will allow LVM to access the local devices used by the
hypervisor, but not shared storage owned by VDSM. If you add a new
device to the volume group, you will need to edit the filter manually.
This is the current LVM filter:
filter = [ "a|^/dev/vda2$|", "a|^/dev/vdb1$|", "r|.*|" ]
WARNING: The current LVM filter does not match the recommended filter,
Vdsm cannot configure the filter automatically.
Please edit /etc/lvm/lvm.conf and set the 'filter' option in the  'devices' section to the recommended value.
It is recommended to reboot after changing LVM filter.
# engine-config -s TransferImageClientInactivityTimeoutInSeconds=6000
# systemctl restart ovirt-engine
# dnf -y install virtio-win
# tree /rhev/data-center
.
|-- 80dfacc7-52dd-4d75-ab82-4f9b8423dc8b
|   |-- 76d1ecba-b61d-45a4-8eb5-89ab710a6275 → /rhev/data-center/mnt/10.10.10.10:_rhevnfssd/76d1ecba-b61d-45a4-8eb5-89ab710a6275
|   |-- b835cd1c-111c-468d-ba70-fec5346af227 → /rhev/data-center/mnt/10.10.10.10:_rhevisosd/b835cd1c-111c-468d-ba70-fec5346af227
|   |-- mastersd → 76d1ecba-b61d-45a4-8eb5-89ab710a6275
|   |-- tasks → mastersd/master/tasks
|   `-- vms → mastersd/master/vms
|-- hsm-tasks
`-- mnt
    |-- 10.10.10.10:_rhevisosd
    |   |-- b835cd1c-111c-468d-ba70-fec5346af227
    |   |   |-- dom_md
    |   |   |   |-- ids
    |   |   |   |-- inbox
    |   |   |   |-- leases
    |   |   |   |-- metadata
    |   |   |   `-- outbox
    |   |   `-- images
    |   |       `-- 11111111-1111-1111-1111-111111111111
    |   `-- lost+found [error opening dir]

(output trimmed)
# scp root@isosource:/isos/example.iso /rhev/data-center/mnt/10.96.4.50:_rhevisosd/b835cd1c-111c-468d-ba70-fec5346af227/images/11111111-1111-1111-1111-111111111111
# cd /rhev/data-center/mnt/10.96.4.50:_rhevisosd/b835cd1c-111c-468d-ba70-fec5346af227/images/11111111-1111-1111-1111-111111111111
# chown 36.36 example.iso
# engine-config -s MaxNumberOfHostsInStoragePool=NUMBER_OF_HOSTS
# service jboss-as restart
# engine-config -s MaxNumberOfHostsInStoragePool=300
# service jboss-as restart
 # engine-config --get=MaxNumberOfHostsInStoragePool
 MaxNumberOfHostsInStoragePool: 250 version: general
$ vdsm-client Host getCapabilities
…
{
    "GLUSTERFS" : [
         0,
         512,
         4096,
    ]
    …
$ vi  /etc/vdsm/vdsm.conf.d/gluster.conf

[gluster]
# Use to disable 4k support
# if needed.
enable_4k_storage = false
<Credentials>
    <Domain>__AD_Domain__</Domain>
    <Password>__Domain_Password__</Password>
    <Username>__Domain_Administrator__</Username>
</Credentials>
<ProductKey>
    <Key><![CDATA[$ProductKey$]]></Key>
</ProductKey>
<ProductKey>
    <Key>0000-000-000-000</Key>
</ProductKey>
<Credentials>
    <Domain>__AD_Domain__</Domain>
    <Password>__Domain_Password__</Password>
    <Username>__Domain_Administrator__</Username>
</Credentials>
<Credentials>
    <Domain>addomain.local</Domain>
    <Password>12345678</Password>
    <Username>Sarah_Smith</Username>
</Credentials>
<UserData>
...
    <FullName>__Local_Administrator__</FullName>
...
</UserData>
<LocalAccounts>
    <LocalAccount wcm:action="add">
        <Password>
            <Value><![CDATA[$AdminPassword$]]></Value>
            <PlainText>true</PlainText>
        </Password>
        <DisplayName>__Local_Administrator__</DisplayName>
        <Group>administrators</Group>
        <Name>__Local_Administrator__</Name>
    </LocalAccount>
</LocalAccounts>
protocol://host:port
# engine-config --set SANWipeAfterDelete=true
# systemctl restart ovirt-engine.service
a9cb0625-d5dc-49ab-8ad1-72722e82b0bf/a49351a7-15d8-4932-8d67-512a369f9d61 was zeroed and will be deleted
finished with VG:a9cb0625-d5dc-49ab-8ad1-72722e82b0bf LVs: {'a49351a7-15d8-4932-8d67-512a369f9d61': ImgsPar(imgs=['11f8b3be-fa96-4f6a-bb83-14c9b12b6e0d'], parent='00000000-0000-0000-0000-000000000000')}, img: 11f8b3be-fa96-4f6a-bb83-14c9b12b6e0d
# virsh -r dumpxml virtual_machine_name
# sudo -u vdsm ssh-keygen
# sudo -u vdsm ssh-copy-id root@xenhost.example.com
# sudo -u vdsm ssh root@xenhost.example.com
# sudo -u vdsm ssh-keygen
# sudo -u vdsm ssh-copy-id root@kvmhost.example.com
# sudo -u vdsm ssh root@kvmhost.example.com
qemu+ssh://root@host.example.com/system
OVESETUP_OVN/ovirtProviderOvn=bool:True
Configuring ovirt-provider-ovn also sets the Default cluster's default network provider to ovirt-provider-ovn.
Non-Default clusters may be configured with an OVN after installation.
Configure ovirt-provider-ovn (Yes, No) [Yes]:
Use default credentials (admin@internal) for ovirt-provider-ovn (Yes, No) [Yes]?:
oVirt OVN provider user[admin]:
oVirt OVN provider password[empty]:
# vdsm-tool ovn-config OVN_Central_IP Tunneling_IP_or_Network_Name Host_FQDN
# vdsm-tool ovn-config 192.168.0.1 MyNetwork MyFQDN
# hosted-engine --set-maintenance --mode=local
# hosted-engine --set-maintenance --mode=none
# hosted-engine --set-maintenance --mode=global
# hosted-engine --set-maintenance --mode=none
# hosted-engine --set-shared-config key --type=type --help
# hosted-engine --set-shared-config smtp-server smtp.example.com --type=broker
# hosted-engine --get-shared-config smtp-server --type=broker
broker : smtp.example.com, type : broker
# hosted-engine --get-shared-config smtp-port --type=broker
broker : 25, type : broker
# hosted-engine --set-shared-config source-email source@example.com --type=broker
# hosted-engine --set-shared-config destination-emails destination1@example.com,destination2@example.com --type=broker
$ ssh root@host_address
# hosted-engine --set-maintenance --mode=global
# hosted-engine --vm-status
# ssh root@host_address
# hosted-engine --vm-shutdown
# hosted-engine --vm-poweroff
hosted-engine --vm-start-paused
hosted-engine --add-console-password
# /usr/bin/virsh -c qemu:///system?authfile=/etc/ovirt-hosted-engine/virsh_auth.conf resume HostedEngine
# hosted-engine --set-maintenance --mode=none
# hosted-engine --set-maintenance --mode=global
# hosted-engine --vm-status
# engine-upgrade-check
# yum update ovirt\*setup\* rh\*vm-setup-plugins
# engine-setup
Execution of setup completed successfully
# yum update --nobest
# hosted-engine --set-maintenance --mode=none
# hosted-engine --vm-status
{"health": "good", "vm": "up", "detail": "Up"}
{"reason": "bad vm status", "health": "bad", "vm": "up", "detail": "Powering up"}
# engine-backup --mode=backup
# engine-backup --mode=restore
# engine-backup
# engine-backup
# engine-backup --scope=files --scope=db
# engine-backup --scope=files --scope=dwhdb
# mkdir -p /etc/ovirt-engine-backup/engine-backup-config.d
BACKUP_PATHS="${BACKUP_PATHS}
/etc/chrony.conf
/etc/ntp.conf
/etc/ovirt-engine-backup"
# engine-backup --mode=restore --file=file_name --log=log_file_name --provision-db
engine-backup --mode=restore --file=file_name --log=log_file_name --provision-db --provision-dwh-db
# engine-backup --mode=restore --scope=files --scope=db --file=file_name --log=log_file_name --provision-db
# engine-backup --mode=restore --scope=files --scope=dwhdb --file=file_name --log=log_file_name --provision-dwh-db
You should now run engine-setup.
Done.
# engine-setup
# engine-cleanup
# engine-backup --mode=restore --file=file_name --log=log_file_name --restore-permissions
# engine-backup --mode=restore --scope=files --scope=db --scope=dwhdb --file=file_name --log=log_file_name --restore-permissions
You should now run engine-setup.
Done.
# engine-setup
# engine-cleanup
# su - postgres -c 'psql'
postgres=# alter role user_name encrypted password 'new_password';
# engine-backup --mode=restore --file=file_name --log=log_file_name --change-db-credentials --db-host=database_location --db-name=database_name --db-user=engine --db-password --no-restore-permissions
engine-backup --mode=restore --file=file_name --log=log_file_name --change-db-credentials --db-host=database_location --db-name=database_name --db-user=engine --db-password --change-dwh-db-credentials --dwh-db-host=database_location --dwh-db-name=database_name --dwh-db-user=ovirt_engine_history --dwh-db-password --no-restore-permissions
# engine-backup --mode=restore --scope=files --scope=db --file=file_name --log=log_file_name --change-db-credentials --db-host=database_location --db-name=database_name --db-user=engine --db-password --no-restore-permissions
# engine-backup --mode=restore --scope=files --scope=dwhdb --file=file_name --log=log_file_name --change-dwh-db-credentials --dwh-db-host=database_location --dwh-db-name=database_name --dwh-db-user=ovirt_engine_history --dwh-db-password --no-restore-permissions
You should now run engine-setup.
Done.
# engine-setup
# hosted-engine --set-maintenance --mode=global
# systemctl stop ovirt-engine
# systemctl disable ovirt-engine
# engine-backup --mode=backup --file=file_name --log=log_file_name
# scp -p file_name log_file_name storage.example.com:/backup/
# subscription-manager unregister
# hosted-engine --vm-shutdown
# scp -p file_name host.example.com:/backup/
# dnf install ovirt-hosted-engine-setup
# dnf -y install tmux
# tmux
# hosted-engine --deploy --restore-from-file=backup/file_name
[ INFO  ] You can now connect to https://<host name>:6900/ovirt-engine/ and check the status of this host and eventually remediate it, please continue only when the host is listed as 'up'
[ INFO  ] TASK [ovirt.ovirt.hosted_engine_setup : include_tasks]
[ INFO  ] ok: [localhost]
[ INFO  ] TASK [ovirt.ovirt.hosted_engine_setup : Create temporary lock file]
[ INFO  ] changed: [localhost]
[ INFO  ] TASK [ovirt.ovirt.hosted_engine_setup : Pause execution until /tmp/ansible.<random>_he_setup_lock is removed, delete it once ready to proceed]
gluster volume set VOLUME_NAME group virt
gluster volume set VOLUME_NAME performance.strict-o-direct on
gluster volume set VOLUME_NAME network.remote-dio off
gluster volume set VOLUME_NAME storage.owner-uid 36
gluster volume set VOLUME_NAME storage.owner-gid 36
gluster volume set VOLUME_NAME network.ping-timeout 30
# subscription-manager register
# subscription-manager list --available
# subscription-manager attach --pool=pool_id
# subscription-manager list --consumed
# dnf repolist
# subscription-manager repos \
    --disable='*' \
    --enable=rhel-8-for-x86_64-baseos-eus-rpms \
    --enable=rhel-8-for-x86_64-appstream-eus-rpms \
    --enable=rhv-4.4-manager-for-rhel-8-x86_64-rpms \
    --enable=fast-datapath-for-rhel-8-x86_64-rpms \
    --enable=jb-eap-7.4-for-rhel-8-x86_64-rpms \
    --enable=openstack-16.2-cinderlib-for-rhel-8-x86_64-rpms \
    --enable=rhceph-4-tools-for-rhel-8-x86_64-rpms
# subscription-manager release --set=8.6
# dnf module -y enable pki-deps
# dnf module -y enable postgresql:12
# dnf module -y enable nodejs:14
# dnf distro-sync --nobest
# hosted-engine --vm-status
# scp -p file_name host.example.com:/backup/
# dnf install ovirt-hosted-engine-setup
# dnf -y install tmux
# tmux
# hosted-engine --deploy --restore-from-file=backup/file_name
[ INFO  ] You can now connect to https://<host name>:6900/ovirt-engine/ and check the status of this host and eventually remediate it, please continue only when the host is listed as 'up'
[ INFO  ] TASK [ovirt.ovirt.hosted_engine_setup : include_tasks]
[ INFO  ] ok: [localhost]
[ INFO  ] TASK [ovirt.ovirt.hosted_engine_setup : Create temporary lock file]
[ INFO  ] changed: [localhost]
[ INFO  ] TASK [ovirt.ovirt.hosted_engine_setup : Pause execution until /tmp/ansible.<random>_he_setup_lock is removed, delete it once ready to proceed]
gluster volume set VOLUME_NAME group virt
gluster volume set VOLUME_NAME performance.strict-o-direct on
gluster volume set VOLUME_NAME network.remote-dio off
gluster volume set VOLUME_NAME storage.owner-uid 36
gluster volume set VOLUME_NAME storage.owner-gid 36
gluster volume set VOLUME_NAME network.ping-timeout 30
# subscription-manager register
# subscription-manager list --available
# subscription-manager attach --pool=pool_id
# subscription-manager list --consumed
# dnf repolist
# subscription-manager repos \
    --disable='*' \
    --enable=rhel-8-for-x86_64-baseos-eus-rpms \
    --enable=rhel-8-for-x86_64-appstream-eus-rpms \
    --enable=rhv-4.4-manager-for-rhel-8-x86_64-rpms \
    --enable=fast-datapath-for-rhel-8-x86_64-rpms \
    --enable=jb-eap-7.4-for-rhel-8-x86_64-rpms \
    --enable=openstack-16.2-cinderlib-for-rhel-8-x86_64-rpms \
    --enable=rhceph-4-tools-for-rhel-8-x86_64-rpms
# subscription-manager release --set=8.6
# dnf module -y enable pki-deps
# dnf module -y enable postgresql:12
# dnf module -y enable nodejs:14
# dnf distro-sync --nobest
# hosted-engine --vm-status
# hosted-engine --set-maintenance --mode=global
# hosted-engine --vm-status
# engine-cleanup
# engine-backup --mode=restore --file=file_name --log=log_file_name --restore-permissions
# engine-backup --mode=restore --scope=files --scope=db --scope=dwhdb --file=file_name --log=log_file_name --restore-permissions
You should now run engine-setup.
Done.
# engine-setup
# hosted-engine --set-maintenance --mode=none
# hosted-engine --vm-status
{"health": "good", "vm": "up", "detail": "Up"}
{"reason": "bad vm status", "health": "bad", "vm": "up", "detail": "Powering up"}
# subscription-manager register
# subscription-manager list --available
# subscription-manager attach --pool=pool_id
# subscription-manager list --consumed
# dnf repolist
# subscription-manager repos \
    --disable='*' \
    --enable=rhel-8-for-x86_64-baseos-eus-rpms \
    --enable=rhel-8-for-x86_64-appstream-eus-rpms \
    --enable=rhv-4.4-manager-for-rhel-8-x86_64-rpms \
    --enable=fast-datapath-for-rhel-8-x86_64-rpms \
    --enable=jb-eap-7.4-for-rhel-8-x86_64-rpms \
    --enable=openstack-16.2-cinderlib-for-rhel-8-x86_64-rpms \
    --enable=rhceph-4-tools-for-rhel-8-x86_64-rpms
# subscription-manager release --set=8.6
# dnf module -y enable postgresql:12
# dnf module -y enable nodejs:14
# dnf distro-sync --nobest
# engine-backup --mode=backup --scope=grafanadb --scope=dwhdb --scope=files --file=file_name --log=log_file_name
# scp /tmp/file_name root@new.dwh.server.com:/tmp
# dnf install ovirt-engine-tools-backup
# dnf install postgresql-server postgresql-contrib
# su - postgres -c 'initdb'
# systemctl enable postgresql
# systemctl start postgresql
# engine-backup --mode=restore --scope=files --scope=grafanadb --scope=dwhdb --file=file_name --log=log_file_name --provision-dwh-db
# subscription-manager register
# subscription-manager list --available
# subscription-manager attach --pool=pool_id
# subscription-manager repos \
    --disable='*' \
    --enable=rhel-8-for-x86_64-baseos-eus-rpms \
    --enable=rhel-8-for-x86_64-appstream-eus-rpms \
    --enable=rhv-4.4-manager-for-rhel-8-x86_64-rpms \
    --enable=fast-datapath-for-rhel-8-x86_64-rpms \
    --enable=jb-eap-7.4-for-rhel-8-x86_64-rpms

# subscription-manager release --set=8.6
# dnf module -y enable pki-deps
# dnf upgrade --nobest
# dnf install ovirt-engine-dwh-setup
# systemctl stop ovirt-engine-dwhd.service
listen_addresses = '*'
# systemctl restart postgresql
# sed -i '/^ENGINE_DB_/d' \
        /etc/ovirt-engine-dwh/ovirt-engine-dwhd.conf.d/10-setup-database.conf

# sed -i \
     -e 's;^\(OVESETUP_ENGINE_CORE/enable=bool\):True;\1:False;' \
     -e '/^OVESETUP_CONFIG\/fqdn/d' \
     /etc/ovirt-engine-setup.conf.d/20-setup-ovirt-post.conf
# rm -f \
  /etc/pki/ovirt-engine/certs/apache.cer \
  /etc/pki/ovirt-engine/certs/apache-grafana.cer \
  /etc/pki/ovirt-engine/keys/apache.key.nopass \
  /etc/pki/ovirt-engine/keys/apache-grafana.key.nopass \
  /etc/pki/ovirt-engine/apache-ca.pem \
  /etc/pki/ovirt-engine/apache-grafana-ca.pem
# engine-setup
Host fully qualified DNS name of this server [autodetected host name]:
Setup can automatically configure the firewall on this system.
Note: automatic configuration of the firewall may overwrite current settings.
Do you want Setup to configure the firewall? (Yes, No) [Yes]:
Host fully qualified DNS name of the engine server []: engine-fqdn
Setup needs to do some actions on the remote engine server. Either automatically, using ssh as root to access it, or you will be prompted to manually perform each such action.
Please choose one of the following:
1 - Access remote engine server using ssh as root
2 - Perform each action manually, use files to copy content around
(1, 2) [1]:
ssh port on remote engine server [22]:
root password on remote engine server engine-fqdn: password
Engine database host []: manager-db-fqdn
Engine database port [5432]:
Engine database secured connection (Yes, No) [No]:
Engine database name [engine]:
Engine database user [engine]:
Engine database password: password
Please confirm installation settings (OK, Cancel) [OK]:
# systemctl disable --now grafana-server.service
# service ovirt-engine restart
# sed -i \
     -e 's;^\(OVESETUP_DWH_CORE/enable=bool\):True;\1:False;' \
     -e 's;^\(OVESETUP_DWH_CONFIG/remoteEngineConfigured=bool\):True;\1:False;' \
     /etc/ovirt-engine-setup.conf.d/20-setup-ovirt-post.conf

# sed -i \
     -e 's;^\(OVESETUP_GRAFANA_CORE/enable=bool\):True;\1:False;' \
     /etc/ovirt-engine-setup.conf.d/20-setup-ovirt-post.conf
# systemctl disable ovirt-engine-dwhd.service
# rm -f /etc/ovirt-engine-dwh/ovirt-engine-dwhd.conf.d/*.conf /var/lib/ovirt-engine-dwh/backups/*
POST /api/vms/{vm:id}/snapshots/ HTTP/1.1
Accept: application/xml
Content-type: application/xml

<snapshot>
    <description>BACKUP</description>
</snapshot>
GET /api/vms/{vm:id}/snapshots/{snapshot:id} HTTP/1.1
All-Content: true
Accept: application/xml
Content-type: application/xml
GET /api/vms/{vm:id}/snapshots/ HTTP/1.1
Accept: application/xml
Content-type: application/xml
GET /api/vms/{vm:id}/snapshots/{snapshot:id}/disks HTTP/1.1
Accept: application/xml
Content-type: application/xml
POST /api/vms/{vm:id}/diskattachments/ HTTP/1.1
Accept: application/xml
Content-type: application/xml

<disk_attachment>
	<active>true</active>
	<interface>_virtio_scsi_</interface>
	<disk id="{disk:id}">
	<snapshot id="{snapshot:id}"/>
	</disk>
</disk_attachment>
DELETE /api/vms/{vm:id}/diskattachments/{snapshot:id} HTTP/1.1
Accept: application/xml
Content-type: application/xml
DELETE /api/vms/{vm:id}/snapshots/{snapshot:id} HTTP/1.1
Accept: application/xml
Content-type: application/xml
POST /api/vms/{vm:id}/disks/ HTTP/1.1
Accept: application/xml
Content-type: application/xml

<disk id="{disk:id}">
</disk>
DELETE /api/vms/{vm:id}/disks/{disk:id} HTTP/1.1
Accept: application/xml
Content-type: application/xml

<action>
    <detach>true</detach>
</action>
POST /api/vms/ HTTP/1.1
Accept: application/xml
Content-type: application/xml

<vm>
    <cluster>
        <name>cluster_name</name>
    </cluster>
    <name>_NAME_</name>
      <initialization>
      <configuration>
  <data>
  <!-- omitting long ovf data -->
  </data>
      <type>ovf</type>
      </configuration>
      </initialization>
    ...
</vm>
POST /api/vms/{vm:id}/disks/ HTTP/1.1
Accept: application/xml
Content-type: application/xml

<disk id="{disk:id}">
</disk>
POST /ovirt-engine/api/vms/123/diskattachments
<disk_attachment>
    …
    <disk>
       …
       <backup>incremental</backup>
       …
    </disk>
</disk_attachment>
<disk_attachment>
    …
    <disk href="/ovirt-engine/api/disks/456" id="456"/>
    …
</disk_attachment>
GET /ovirt-engine/api/vms/123/diskattachments
<disk_attachments>
    <disk_attachment>
       …
       <disk href="/ovirt-engine/api/disks/456" id="456"/>
       …
    </disk_attachment>
    …
</disk_attachments>
GET /ovirt-engine/api/disks/456
<disk href="/ovirt-engine/api/disks/456" id="456">
    …
    <backup>incremental</backup>
    …
</disk>
POST /ovirt-engine/api/vms/123/backups
<backup>
    <disks>
       <disk id="456" />
       …
    </disks>
</backup>
<backup id="789">
    <disks>
       <disk id="456" />
       …
       …
    </disks>
    <status>initializing</status>
    <creation_date>
</backup>
POST /ovirt-engine/api/vms/123/backups
<backup>
    <from_checkpoint_id>previous-checkpoint-uuid</from_checkpoint_id>
    <disks>
       <disk id="456" />
       …
    </disks>
</backup>
<backup>
    <from_checkpoint_id>previous-checkpoint-uuid</from_checkpoint_id>
    <disks>
       <disk id="456" />
       <disk id="789" />
       …
    </disks>
</backup>
<backup id="101112">
<from_checkpoint_id>previous-checkpoint-uuid</from_checkpoint_id>
<to_checkpoint_id>new-checkpoint-uuid</to_checkpoint_id>
    <disks>
       <disk id="456" />
       <disk id="789" />
       …
       …
    </disks>
    <status>initializing</status>
    <creation_date>
</backup>
GET /ovirt-engine/api/vms/456/backups/123
<backup id="456">
    <from_checkpoint_id>999</from_checkpoint_id>
    <to_checkpoint_id>666</to_checkpoint_id>
    <link href="/ovirt-engine/api/vms/456/backups/123/disks" rel="disks"/>
    <status>ready</status>
    <creation_date>
</backup>
GET /ovirt-engine/api/vms/456/backups/123/disks
<disks>
    <disk id="789">
        <name>vm1_Disk1</name>
        <actual_size>671744</actual_size>
        <backup>incremental</backup>
        <backup_mode>full</backup_mode>
        <format>cow</format>
        <image_id>555</image_id>
        <qcow_version>qcow2_v3</qcow_version>
        <status>locked</status>
        <storage_type>image</storage_type>
        <total_size>0</total_size>
    </disk>
</disks>
POST /vms/123/backups/456/finalize
POST /ovirt-engine/api/imagetransfers
<image_transfer>
    <disk id="123"/>
    <backup id="456"/>
    <direction>download</direction>
    <format>raw</format>
</image_transfer>
POST /ovirt-engine/api/imagetransfers
<image_transfer>
    <disk id="123"/>
    <direction>upload</direction>
    <format>raw</format>
</image_transfer>
GET /vms/123/checkpoints/
<parent_id>, <creation_date> and the virtual machine it belongs to <vm>:
<checkpoints>
    <checkpoint id="456">
         <link href="/ovirt-engine/api/vms/vm-uuid/checkpoints/456/disks" rel="disks"/>
         <parent_id>parent-checkpoint-uuid</parent_id>
         <creation_date>xxx</creation_date>
         <vm href="/ovirt-engine/api/vms/123" id="123"/>
    </checkpoint>
</checkpoints>
GET /vms/123/checkpoints/456
<checkpoint id="456">
     <link href="/ovirt-engine/api/vms/vm-uuid/checkpoints/456/disks" rel="disks"/>
     <parent_id>parent-checkpoint-uuid</parent_id>
     <creation_date>xxx</creation_date>
     <vm href="/ovirt-engine/api/vms/123" id="123"/>
</checkpoint>
DELETE /vms/123/checkpoints/456/
# hosted-engine --set-maintenance --mode=global
# engine-setup --offline
Renew certificates? (Yes, No) [Yes]:
# hosted-engine --set-maintenance --mode=none
# dnf install ovirt-ansible-collection
# ansible-galaxy collection install redhat.rhv
- name: RHV infrastructure
  hosts: localhost
  connection: local
  gather_facts: false

  vars_files:
   # Contains variables to connect to the Manager
   - engine_vars.yml
   # Contains encrypted engine_password variable using ansible-vault
   - passwords.yml

  pre_tasks:
   # The use of redhat.rhv before ovirt_auth is to check if oVirt Ansible Collection is correctly loaded
   - name: Login to RHV
     redhat.rhv.ovirt_auth:
       hostname: "{{ engine_fqdn }}"
       username: "{{ engine_user }}"
       password: "{{ engine_password }}"
       ca_file: "{{ engine_cafile | default(omit) }}"
       insecure: "{{ engine_insecure | default(true) }}"
     tags:
       - always

 vars:
   data_center_name: mydatacenter
   data_center_description: mydatacenter
   data_center_local: false
   compatibility_version: 4.4

 roles:
   - infra
 collections:
   - redhat.rhv
 post_tasks:
   - name: Logout from RHV
     ovirt_auth:
       state: absent
       ovirt_auth: "{{ ovirt_auth }}"
     tags:
       - always
# dnf install ovirt-engine-extension-aaa-ldap-setup
# ovirt-engine-extension-aaa-ldap-setup
Available LDAP implementations:
 1 - 389ds
 2 - 389ds RFC-2307 Schema
 3 - Active Directory
 4 - IBM Security Directory Server
 5 - IBM Security Directory Server RFC-2307 Schema
 6 - IPA
 7 - Novell eDirectory RFC-2307 Schema
 8 - OpenLDAP RFC-2307 Schema
 9 - OpenLDAP Standard Schema
10 - Oracle Unified Directory RFC-2307 Schema
11 - RFC-2307 Schema (Generic)
12 - RHDS
13 - RHDS RFC-2307 Schema
14 - iPlanet
Please select:
It is highly recommended to use DNS resolution for LDAP server.
If for some reason you intend to use hosts or plain address disable DNS usage.
Use DNS (Yes, No) [Yes]:
_service._protocol.domain_name
1 - Single server
2 - DNS domain LDAP SRV record
3 - Round-robin between multiple hosts
4 - Failover between multiple hosts
Please select:
NOTE:
It is highly recommended to use secure protocol to access the LDAP server.
Protocol startTLS is the standard recommended method to do so.
Only in cases in which the startTLS is not supported, fallback to non standard ldaps protocol.
Use plain for test environments only.
Please select protocol to use (startTLS, ldaps, plain) [startTLS]: startTLS
Please select method to obtain PEM encoded CA certificate (File, URL, Inline, System, Insecure):
Please enter the password:
Enter search user DN (for example uid=username,dc=example,dc=com or leave empty for anonymous): uid=user1,ou=Users,ou=department-1,dc=example,dc=com
Enter search user password:
Please enter base DN (dc=redhat,dc=com) [dc=redhat,dc=com]: ou=department-1,dc=redhat,dc=com
Are you going to use Single Sign-On for Virtual Machines (Yes, No) [Yes]:
Please specify profile name that will be visible to users: redhat.com
NOTE:
It is highly recommended to test drive the configuration before applying it into engine.
Login sequence is executed automatically, but it is recommended to also execute Search sequence manually after successful Login sequence.

Please provide credentials to test login flow:
Enter user name:
Enter user password:
[ INFO  ] Executing login sequence…
…
[ INFO  ] Login sequence executed successfully
Please make sure that user details are correct and group membership meets expectations (search for PrincipalRecord and GroupRecord titles).
Abort if output is incorrect.
Select test sequence to execute (Done, Abort, Login, Search) [Abort]:
Select test sequence to execute (Done, Abort, Login, Search) [Search]: Search
Select entity to search (Principal, Group) [Principal]:
Term to search, trailing '*' is allowed: testuser1
Resolve Groups (Yes, No) [No]:
Select test sequence to execute (Done, Abort, Login, Search) [Abort]: Done
[ INFO  ] Stage: Transaction setup
[ INFO  ] Stage: Misc configuration
[ INFO  ] Stage: Package installation
[ INFO  ] Stage: Misc configuration
[ INFO  ] Stage: Transaction commit
[ INFO  ] Stage: Closing up
CONFIGURATION SUMMARY
Profile name is: redhat.com
The following files were created:
    /etc/ovirt-engine/aaa/redhat.com.properties
    /etc/ovirt-engine/extensions.d/redhat.com.properties
    /etc/ovirt-engine/extensions.d/redhat.com-authn.properties
[ INFO  ] Stage: Clean up
Log file is available at /tmp/ovirt-engine-extension-aaa-ldap-setup-20171004101225-mmneib.log:
[ INFO  ] Stage: Pre-termination
[ INFO  ] Stage: Termination
# systemctl restart ovirt-engine.service
# dnf install ovirt-engine-extension-aaa-ldap-setup
# ovirt-engine-extension-aaa-ldap-setup
Available LDAP implementations:
 1 - 389ds
 2 - 389ds RFC-2307 Schema
 3 - Active Directory
 4 - IBM Security Directory Server
 5 - IBM Security Directory Server RFC-2307 Schema
 6 - IPA
 7 - Novell eDirectory RFC-2307 Schema
 8 - OpenLDAP RFC-2307 Schema
 9 - OpenLDAP Standard Schema
10 - Oracle Unified Directory RFC-2307 Schema
11 - RFC-2307 Schema (Generic)
12 - RHDS
13 - RHDS RFC-2307 Schema
14 - iPlanet
Please select: 3
Please enter Active Directory Forest name: ad-example.redhat.com
[ INFO  ] Resolving Global Catalog SRV record for ad-example.redhat.com
[ INFO  ] Resolving LDAP SRV record for ad-example.redhat.com
NOTE:
It is highly recommended to use secure protocol to access the LDAP server.
Protocol startTLS is the standard recommended method to do so.
Only in cases in which the startTLS is not supported, fallback to non standard ldaps protocol.
Use plain for test environments only.
Please select protocol to use (startTLS, ldaps, plain) [startTLS]: startTLS
Please select method to obtain PEM encoded CA certificate (File, URL, Inline, System, Insecure): File
Please enter the password:
Enter search user DN (empty for anonymous): cn=user1,ou=Users,dc=test,dc=redhat,dc=com
Enter search user password:
Are you going to use Single Sign-On for Virtual Machines (Yes, No) [Yes]:
Please specify profile name that will be visible to users:redhat.com
NOTE:
It is highly recommended to test drive the configuration before applying it into engine.
Login sequence is executed automatically, but it is recommended to also execute Search sequence manually after successful Login sequence.
Select test sequence to execute (Done, Abort, Login, Search) [Abort]: Login
Enter search user name: testuser1
Enter search user password:
[ INFO  ] Executing login sequence...
...
Select test sequence to execute (Done, Abort, Login, Search) [Abort]: Search
Select entity to search (Principal, Group) [Principal]:
Term to search, trailing '*' is allowed: testuser1
Resolve Groups (Yes, No) [No]:
[ INFO  ] Executing login sequence...
...
Select test sequence to execute (Done, Abort, Login, Search) [Abort]: Done
[ INFO  ] Stage: Transaction setup
[ INFO  ] Stage: Misc configuration
[ INFO  ] Stage: Package installation
[ INFO  ] Stage: Misc configuration
[ INFO  ] Stage: Transaction commit
[ INFO  ] Stage: Closing up
          CONFIGURATION SUMMARY
          Profile name is: redhat.com
          The following files were created:
              /etc/ovirt-engine/aaa/redhat.com.properties
              /etc/ovirt-engine/extensions.d/redhat.com-authz.properties
              /etc/ovirt-engine/extensions.d/redhat.com-authn.properties
[ INFO  ] Stage: Clean up
          Log file is available at /tmp/ovirt-engine-extension-aaa-ldap-setup-20160114064955-1yar9i.log:
[ INFO  ] Stage: Pre-termination
[ INFO  ] Stage: Termination
# dnf install ovirt-engine-extension-aaa-ldap
# cp -r /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple/. /etc/ovirt-engine
# mv /etc/ovirt-engine/aaa/profile1.properties /etc/ovirt-engine/aaa/example.properties
# mv /etc/ovirt-engine/extensions.d/profile1-authn.properties /etc/ovirt-engine/extensions.d/example-authn.properties
# mv /etc/ovirt-engine/extensions.d/profile1-authz.properties /etc/ovirt-engine/extensions.d/example-authz.properties
#  vi /etc/ovirt-engine/aaa/example.properties
# Select one
#
include = <openldap.properties>
#include = <389ds.properties>
#include = <rhds.properties>
#include = <ipa.properties>
#include = <iplanet.properties>
#include = <rfc2307-389ds.properties>
#include = <rfc2307-rhds.properties>
#include = <rfc2307-openldap.properties>
#include = <rfc2307-edir.properties>
#include = <rfc2307-generic.properties>

# Server
#
vars.server = ldap1.company.com

# Search user and its password.
#
vars.user = uid=search,cn=users,cn=accounts,dc=company,dc=com
vars.password = 123456

pool.default.serverset.single.server = ${global:vars.server}
pool.default.auth.simple.bindDN = ${global:vars.user}
pool.default.auth.simple.password = ${global:vars.password}
# Create keystore, import certificate chain and uncomment
# if using tls.
pool.default.ssl.startTLS = true
pool.default.ssl.truststore.file = /full/path/to/myrootca.jks
pool.default.ssl.truststore.password = password
# vi /etc/ovirt-engine/extensions.d/example-authn.properties
ovirt.engine.extension.name = example-authn
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.ldap
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.ldap.AuthnExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn
ovirt.engine.aaa.authn.profile.name = example
ovirt.engine.aaa.authn.authz.plugin = example-authz
config.profile.file.1 = ../aaa/example.properties
# vi /etc/ovirt-engine/extensions.d/example-authz.properties
ovirt.engine.extension.name = example-authz
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.ldap
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.ldap.AuthzExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz
config.profile.file.1 = ../aaa/example.properties
# chown ovirt:ovirt /etc/ovirt-engine/aaa/example.properties
# chmod 600 /etc/ovirt-engine/aaa/example.properties
# systemctl restart ovirt-engine.service
# rm /etc/ovirt-engine/extensions.d/profile1-authn.properties
# rm /etc/ovirt-engine/extensions.d/profile1-authz.properties
# rm /etc/ovirt-engine/aaa/profile1.properties
# systemctl restart ovirt-engine
# kadmin
kadmin> addprinc -randkey HTTP/fqdn-of-rhevm@REALM.COM
kadmin> ktadd -k /tmp/http.keytab HTTP/fqdn-of-rhevm@REALM.COM
kadmin> quit
# scp /tmp/http.keytab root@rhevm.example.com:/etc/httpd
# chown apache /etc/httpd/http.keytab
# chmod 400 /etc/httpd/http.keytab
# dnf install ovirt-engine-extension-aaa-misc ovirt-engine-extension-aaa-ldap mod_auth_gssapi mod_session
# cp -r /usr/share/ovirt-engine-extension-aaa-ldap/examples/simple-sso/. /etc/ovirt-engine
# mv /etc/ovirt-engine/aaa/ovirt-sso.conf /etc/httpd/conf.d
# vi /etc/httpd/conf.d/ovirt-sso.conf
<LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-http-auth)|^/ovirt-engine/api>
  <If "req('Authorization') !~ /^(Bearer|Basic)/i">
    RewriteEngine on
    RewriteCond %{LA-U:REMOTE_USER} ^(.*)$
    RewriteRule ^(.*)$ - [L,NS,P,E=REMOTE_USER:%1]
    RequestHeader set X-Remote-User %{REMOTE_USER}s

    AuthType GSSAPI
    AuthName "Kerberos Login"

    # Modify to match installation
    GssapiCredStore keytab:/etc/httpd/http.keytab
    GssapiUseSessions On
    Session On
    SessionCookieName ovirt_gssapi_session path=/private;httponly;secure;

    Require valid-user
    ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>"
  </If>
</LocationMatch>
# mv /etc/ovirt-engine/aaa/profile1.properties /etc/ovirt-engine/aaa/example.properties
# mv /etc/ovirt-engine/extensions.d/profile1-http-authn.properties /etc/ovirt-engine/extensions.d/example-http-authn.properties
# mv /etc/ovirt-engine/extensions.d/profile1-http-mapping.properties /etc/ovirt-engine/extensions.d/example-http-mapping.properties
# mv /etc/ovirt-engine/extensions.d/profile1-authz.properties /etc/ovirt-engine/extensions.d/example-authz.properties
#  vi /etc/ovirt-engine/aaa/example.properties
# Select one
include = <openldap.properties>
#include = <389ds.properties>
#include = <rhds.properties>
#include = <ipa.properties>
#include = <iplanet.properties>
#include = <rfc2307-389ds.properties>
#include = <rfc2307-rhds.properties>
#include = <rfc2307-openldap.properties>
#include = <rfc2307-edir.properties>
#include = <rfc2307-generic.properties>

# Server
#
vars.server = ldap1.company.com

# Search user and its password.
#
vars.user = uid=search,cn=users,cn=accounts,dc=company,dc=com
vars.password = 123456

pool.default.serverset.single.server = ${global:vars.server}
pool.default.auth.simple.bindDN = ${global:vars.user}
pool.default.auth.simple.password = ${global:vars.password}
# Create keystore, import certificate chain and uncomment
# if using ssl/tls.
pool.default.ssl.startTLS = true
pool.default.ssl.truststore.file = /full/path/to/myrootca.jks
pool.default.ssl.truststore.password = password
# vi /etc/ovirt-engine/extensions.d/example-http-authn.properties
ovirt.engine.extension.name = example-http-authn
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.misc
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.misc.http.AuthnExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn
ovirt.engine.aaa.authn.profile.name = example-http
ovirt.engine.aaa.authn.authz.plugin = example-authz
ovirt.engine.aaa.authn.mapping.plugin = example-http-mapping
config.artifact.name = HEADER
config.artifact.arg = X-Remote-User
#  vi /etc/ovirt-engine/extensions.d/example-authz.properties
ovirt.engine.extension.name = example-authz
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.ldap
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.ldap.AuthzExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz
config.profile.file.1 = ../aaa/example.properties
# vi /etc/ovirt-engine/extensions.d/example-http-mapping.properties
ovirt.engine.extension.name = example-http-mapping
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.misc
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.misc.mapping.MappingExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Mapping
config.mapAuthRecord.type = regex
config.mapAuthRecord.regex.mustMatch = true
config.mapAuthRecord.regex.pattern = ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$
config.mapAuthRecord.regex.replacement = ${user}${at}${suffix}
# chown ovirt:ovirt /etc/ovirt-engine/aaa/example.properties
# chown ovirt:ovirt /etc/ovirt-engine/extensions.d/example-http-authn.properties
# chown ovirt:ovirt /etc/ovirt-engine/extensions.d/example-http-mapping.properties
# chown ovirt:ovirt /etc/ovirt-engine/extensions.d/example-authz.properties
# chmod 600 /etc/ovirt-engine/aaa/example.properties
# chmod 640 /etc/ovirt-engine/extensions.d/example-http-authn.properties
# chmod 640 /etc/ovirt-engine/extensions.d/example-http-mapping.properties
# chmod 640 /etc/ovirt-engine/extensions.d/example-authz.properties
# systemctl restart httpd.service
# systemctl restart ovirt-engine.service
# dnf module enable mod_auth_openidc:2.3 -y
# dnf install mod_auth_openidc
LoadModule auth_openidc_module modules/mod_auth_openidc.so

OIDCProviderMetadataURL https://SSO.example.com/auth/realms/master/.well-known/openid-configuration
OIDCSSLValidateServer Off

OIDCClientID ovirt-engine
OIDCClientSecret <client_SSO _generated_key>
OIDCRedirectURI https://rhvm.example.com/ovirt-engine/callback
OIDCDefaultURL https://rhvm.example.com/ovirt-engine/login?scope=ovirt-app-admin+ovirt-app-portal+ovirt-ext%3Dauth%3Asequence-priority%3D%7E

# maps the prefered_username claim to the REMOTE_USER environment variable:

OIDCRemoteUserClaim <preferred_username>
OIDCCryptoPassphrase <random1234>

<LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-http-auth)|^/ovirt-engine/callback>
    <If "req('Authorization') !~ /^(Bearer|Basic)/i">

      Require valid-user
      AuthType openid-connect

      ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>"
    </If>
</LocationMatch>

OIDCOAuthIntrospectionEndpoint https://SSO.example.com/auth/realms/master/protocol/openid-connect/token/introspect
OIDCOAuthSSLValidateServer    Off
OIDCOAuthIntrospectionEndpointParams token_type_hint=access_token
OIDCOAuthClientID ovirt-engine
OIDCOAuthClientSecret <client_SSO _generated_key>
OIDCOAuthRemoteUserClaim sub

<LocationMatch ^/ovirt-engine/(api$|api/)>
   AuthType oauth20
   Require valid-user
</LocationMatch>
# systemctl restart httpd
# systemctl restart ovirt-engine
ovirt.engine.extension.name = openidc-authn
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.misc
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.misc.http.AuthnExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn
ovirt.engine.aaa.authn.profile.name = openidchttp
ovirt.engine.aaa.authn.authz.plugin = openidc-authz
ovirt.engine.aaa.authn.mapping.plugin = openidc-http-mapping
config.artifact.name = HEADER
config.artifact.arg = OIDC_CLAIM_preferred_username
ovirt.engine.extension.name = openidc-http-mapping
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.misc
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.misc.mapping.MappingExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Mapping
config.mapAuthRecord.type = regex
config.mapAuthRecord.regex.mustMatch = false
config.mapAuthRecord.regex.pattern = ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$
config.mapAuthRecord.regex.replacement = ${user}${at}${suffix}
ovirt.engine.extension.name = openidc-authz
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine.extension.aaa.misc
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engine.extension.aaa.misc.http.AuthzExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz
config.artifact.name.arg = OIDC_CLAIM_preferred_username
config.artifact.groups.arg = OIDC_CLAIM_groups
ENGINE_SSO_ENABLE_EXTERNAL_SSO=true
ENGINE_SSO_EXTERNAL_SSO_LOGOUT_URI="${ENGINE_URI}/callback"
EXTERNAL_OIDC_USER_INFO_END_POINT=https://SSO.example.com/auth/realms/master/protocol/openid-connect/userinfo
EXTERNAL_OIDC_TOKEN_END_POINT=https://SSO.example.com/auth/realms/master/protocol/openid-connect/token
EXTERNAL_OIDC_LOGOUT_END_POINT=https://SSO.example.com/auth/realms/master/protocol/openid-connect/logout
EXTERNAL_OIDC_CLIENT_ID=ovirt-engine
EXTERNAL_OIDC_CLIENT_SECRET="<client_SSO _generated_key>"
EXTERNAL_OIDC_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"
EXTERNAL_OIDC_HTTPS_PKI_TRUST_STORE_PASSWORD=""
EXTERNAL_OIDC_SSL_VERIFY_CHAIN=false
EXTERNAL_OIDC_SSL_VERIFY_HOST=false
[OVIRT]
ovirt-admin-user-name=user1@openidchttp
# systemctl restart ovirt-provider-ovn
(...)
#################################### Generic OAuth #######################
[auth.generic_oauth]
name = oVirt Engine Auth
enabled = true
allow_sign_up = true
client_id = ovirt-engine
client_secret = <client-secret-of-RH-SSO>
scopes = openid,ovirt-app-admin,ovirt-app-portal,ovirt-ext=auth:sequence-priority=~
email_attribute_name = email:primary
role_attribute_path = "contains(realm_access.roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'editor') && 'Editor' || 'Viewer'"
auth_url = https://<rh-sso-hostname>/auth/realms/<RH-SSO-REALM>/protocol/openid-connect/auth
token_url = https://<rh-sso-hostname>/auth/realms/<RH-SSO-REALM>/protocol/openid-connect/token
api_url = https://<rh-sso-hostname>/auth/realms/<RH-SSO-REALM>/protocol/openid-connect/userinfo
team_ids =
allowed_organizations =
tls_skip_verify_insecure = false
tls_client_cert =
tls_client_key =
tls_client_ca = /etc/pki/ovirt-engine/apache-ca.pem
send_client_credentials_via_post = false
(...)
# ovirt-aaa-jdbc-tool user add test1 --attribute=firstName=John --attribute=lastName=Doe
adding user test1...
user added successfully
# ovirt-aaa-jdbc-tool user password-reset test1 --password-valid-to="2025-08-01 12:00:00-0800"
Password:
updating user test1...
user updated successfully
# engine-config --set UserSessionTimeOutInterval=integer
# /usr/share/ovirt-engine/bin/ovirt-engine-crypto-tool.sh pbe-encode
# /usr/share/ovirt-engine/bin/ovirt-engine-crypto-tool.sh pbe-encode --password=file:file
# ovirt-aaa-jdbc-tool user password-reset test1 --password-valid-to="2025-08-01 12:00:00-0800" --encrypted
Password:
Reenter password:
updating user test1...
user updated successfully
# ovirt-aaa-jdbc-tool user show test1
# ovirt-aaa-jdbc-tool user edit test1 --attribute=email=jdoe@example.com
# ovirt-aaa-jdbc-tool user delete test1
# ovirt-aaa-jdbc-tool user edit admin --flag=+disabled
# ovirt-aaa-jdbc-tool group add group1
# ovirt-aaa-jdbc-tool group-manage useradd group1 --user=test1
# ovirt-aaa-jdbc-tool group show group1
# ovirt-aaa-jdbc-tool group add group1
# ovirt-aaa-jdbc-tool group add group1-1
# ovirt-aaa-jdbc-tool group-manage groupadd group1 --group=group1-1
# ovirt-aaa-jdbc-tool query --what=user
# ovirt-aaa-jdbc-tool query --what=group
# ovirt-aaa-jdbc-tool query --what=user --pattern="name=j*"
# ovirt-aaa-jdbc-tool query --what=group --pattern="department=marketing"
# ovirt-aaa-jdbc-tool settings show
# ovirt-aaa-jdbc-tool settings set --name=MAX_LOGIN_MINUTES --value=60
# ovirt-aaa-jdbc-tool settings set --name=MAX_FAILURES_SINCE_SUCCESS --value=3
# cp /usr/share/ovirt-engine/services/ovirt-engine-notifier/ovirt-engine-notifier.conf /etc/ovirt-engine/notifier/notifier.conf.d/90-email-notify.conf
#---------------------#
# EMAIL Notifications #
#---------------------#

# The SMTP mail server address. Required.
MAIL_SERVER=myemailserver.example.com

# The SMTP port (usually 25 for plain SMTP, 465 for SMTP with SSL, 587 for SMTP with TLS)
MAIL_PORT=25

# Required if SSL or TLS enabled to authenticate the user. Used also to specify 'from' user address if mail server
# supports, when MAIL_FROM is not set. Address is in RFC822 format
MAIL_USER=

# Required to authenticate the user if mail server requires authentication or if SSL or TLS is enabled
SENSITIVE_KEYS="${SENSITIVE_KEYS},MAIL_PASSWORD"
MAIL_PASSWORD=

# Indicates type of encryption (none, ssl or tls) should be used to communicate with mail server.
MAIL_SMTP_ENCRYPTION=none

# If set to true, sends a message in HTML format.
HTML_MESSAGE_FORMAT=false

# Specifies 'from' address on sent mail in RFC822 format, if supported by mail server.
MAIL_FROM=rhevm2017@example.com

# Specifies 'reply-to' address on sent mail in RFC822 format.
MAIL_REPLY_TO=

# Interval to send smtp messages per # of IDLE_INTERVAL
MAIL_SEND_INTERVAL=1

# Amount of times to attempt sending an email before failing.
MAIL_RETRIES=4
# systemctl daemon-reload
# systemctl enable ovirt-engine-notifier.service
# systemctl restart ovirt-engine-notifier.service
# vi /etc/ovirt-engine/notifier/notifier.conf.d/20-snmp.conf
SNMP_MANAGERS="manager1.example.com manager2.example.com:162"
SNMP_COMMUNITY=public
SNMP_OID=1.3.6.1.4.1.2312.13.1.1
SNMP_VERSION=3
SNMP_ENGINE_ID="80:00:00:00:01:02:05:05"
SNMP_USERNAME=NoAuthNoPriv
SNMP_SECURITY_LEVEL=1
SNMP_USERNAME=ovirtengine
SNMP_AUTH_PROTOCOL=MD5
SNMP_AUTH_PASSPHRASE=authpass
SNMP_SECURITY_LEVEL=2
SNMP_USERNAME=ovirtengine
SNMP_AUTH_PROTOCOL=MD5
SNMP_AUTH_PASSPHRASE=authpass
SNMP_PRIVACY_PROTOCOL=AES128
SNMP_PRIVACY_PASSPHRASE=privpass
SNMP_SECURITY_LEVEL=3
FILTER="include:*(snmp:) ${FILTER}"
FILTER="include:*:ERROR(snmp:) ${FILTER}"
FILTER="include:*:ALERT(snmp:) ${FILTER}"
FILTER="include:VDC_START(snmp:mail@example.com) ${FILTER}"
FILTER="exclude:VDC_START include:*(snmp:) ${FILTER}"
FILTER="exclude:*"
# systemctl start ovirt-engine-notifier.service
# systemctl enable ovirt-engine-notifier.service
SNMP_MANAGERS="manager1.example.com manager2.example.com:162" 1
SNMP_COMMUNITY=public 2
SNMP_OID=1.3.6.1.4.1.2312.13.1.1 3
FILTER="include:*(snmp:)" 4
SNMP_VERSION=3 5
SNMP_ENGINE_ID="80:00:00:00:01:02:05:05" 6
SNMP_USERNAME=<username> 7
SNMP_AUTH_PROTOCOL=MD5 8
SNMP_AUTH_PASSPHRASE=<authpass> 9
SNMP_PRIVACY_PROTOCOL=AES128 10
SNMP_PRIVACY_PASSPHRASE=<privpass> 11
SNMP_SECURITY_LEVEL=3 12
  ----
  # echo 'SSO_ALTERNATE_ENGINE_FQDNS="alias1.example.com alias2.example.com"' \
  > /etc/ovirt-engine/engine.conf.d/99-custom-sso-setup.conf
  # systemctl restart ovirt-engine.service
  ----
. List the alternate names separated by spaces.
# /usr/share/ovirt-engine/setup/bin/ovirt-engine-rename
# /usr/share/ovirt-engine/setup/bin/ovirt-engine-rename
During execution engine service will be stopped (OK, Cancel) [OK]:
New fully qualified server name:new_engine_fqdn
# hosted-engine --set-shared-config fqdn new_engine_fqdn --type=he_local
# hosted-engine --set-shared-config fqdn new_engine_fqdn --type=he_shared
# engine-setup --offline
# engine-config --help
# engine-config --list
# engine-config --all
# engine-config --get KEY_NAME
# engine-config --set KEY_NAME=KEY_VALUE --cver=VERSION
# systemctl restart ovirt-engine.service
# systemctl restart ovirt-engine.service
# rhv-image-discrepancies
 Checking storage domain c277ad93-0973-43d9-a0ca-22199bc8e801
    Looking for missing images...
    No missing images found
    Checking discrepancies between SD/DB attributes...
    image ef325650-4b39-43cf-9e00-62b9f7659020 has a different attribute capacity on storage(2696984576) and on DB(2696986624)
    image 852613ce-79ee-4adc-a56a-ea650dcb4cfa has a different attribute capacity on storage(5424252928) and on DB(5424254976)

 Checking storage domain c64637b4-f0e8-408c-b8af-6a52946113e2
    Looking for missing images...
    No missing images found
    Checking discrepancies between SD/DB attributes...
    No discrepancies found
# ovirt-log-collector options  list all|clusters|datacenters
# ovirt-log-collector options collect
# ovirt-log-collector
INFO: Gathering oVirt Engine information...
INFO: Gathering PostgreSQL the oVirt Engine database and log files from localhost...
Please provide REST API password for the admin@internal oVirt Engine user (CTRL+D to abort):
About to collect information from 3 hypervisors. Continue? (Y/n):
INFO: Gathering information from selected hypervisors...
INFO: collecting information from 192.168.122.250
INFO: collecting information from 192.168.122.251
INFO: collecting information from 192.168.122.252
INFO: finished collecting information from 192.168.122.250
INFO: finished collecting information from 192.168.122.251
INFO: finished collecting information from 192.168.122.252
Creating compressed archive...
INFO Log files have been collected and placed in /tmp/logcollector/sosreport-rhn-account-20110804121320-ce2a.tar.xz.
The MD5 for this file is 6d741b78925998caff29020df2b2ce2a and its size is 26.7M
$ engine-setup
...
[ INFO  ] Stage: Environment customization
...
Perform full vacuum on the engine database engine@localhost?
This operation may take a while depending on this setup health and the
configuration of the db vacuum process.
See https://www.postgresql.org/docs/12/static/sql-vacuum.html
(Yes, No) [No]:
# engine-vacuum
# engine-vacuum option
# engine-vacuum -f -v -t vm_dynamic -t vds_dynamic
# export PASSWORD=DatabaseUserPassword
# vdsm_to_network_name_map  --user USER
# hosted-engine --set-maintenance --mode=global
# engine-setup --reconfigure-optional-components
Configure Grafana on this host (Yes, No) [Yes]:
# hosted-engine --set-maintenance --mode=none
# cp /etc/ovirt-engine-metrics/config.yml.example /etc/ovirt-engine-metrics/config.yml.d/config.yml
use_omelasticsearch_cert: false
rsyslog_elasticsearch_usehttps_metrics: !!str off
rsyslog_elasticsearch_usehttps_logs: !!str off
# /usr/share/ovirt-engine-metrics/setup/ansible/configure_ovirt_machines_for_metrics.sh
[root@server ~]# insights-client --register
upload-json=True
$ killall - u $USER spice-vdagent
$ spice-vdagent -x -d [-d] [ |& tee spice-vdagent.log ]
#  remote-viewer --spice-debug
# remote-viewer --spice-debug /path/to/console.vv
remote-viewer --spice-debug path\to\console.vv
OVIRT_SERVICE_DEBUG=1
# systemctl restart <service>
# firewall-cmd --query-service=syslog
# firewall-cmd --add-service=syslog --permanent
# firewall-cmd --reload
template(name="DynFile" type="string" string="/var/log/%HOSTNAME%/%PROGRAMNAME%.log")
RuleSet(name="RemoteMachine"){  action(type="omfile" dynaFile="DynFile")  }
Module(load="imudp")
Input(type="imudp" port="514" ruleset="RemoteMachine")
# systemctl restart rsyslog.service
*.info;mail.none;authpriv.none;cron.none @<syslog-FQDN>:514
# systemctl restart rsyslog.service
SYSLOG_HANDLER_ENABLED=true
SYSLOG_HANDLER_SERVER_HOSTNAME=localhost
SYSLOG_HANDLER_FACILITY=USER_LEVEL
# dnf install rsyslog
# semanage port -a -t syslogd_port_t -p udp 514
user.* /var/log/jboss.log
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")
# systemctl restart rsyslog.service
# firewall-cmd --permanent --add-port=514/udp
# firewall-cmd --reload
# systemctl restart ovirt-engine
# dnf list vdsm\*hook\*
# dnf install <vdsm-hook-name>
# dnf install vdsm-hook-vhostmd
# engine-config -g UserDefinedVMProperties
# engine-config -g UserDefinedVMProperties
UserDefinedVMProperties:  version: 4.3
UserDefinedVMProperties:  version: 4.4
UserDefinedVMProperties : memory=^[0-9]+$ version: 4.4
# engine-config -s UserDefinedVMProperties='memory=^[0-9]+$;smartcard=^(true|false)$' --cver=4.4
# engine-config -g UserDefinedVMProperties
UserDefinedVMProperties:  version: 4.3
UserDefinedVMProperties:  version: 4.4
UserDefinedVMProperties : memory=^[0-9]+$;smartcard=^(true|false)$ version: 4.4
# systemctl restart ovirt-engine.service
# engine-config -g CustomDeviceProperties
# engine-config -g CustomDeviceProperties
CustomDeviceProperties:  version: 4.3
CustomDeviceProperties:  version: 4.4
# engine-config -s CustomDeviceProperties="{type=interface;prop={speed=^([0-9]{1,5})$;duplex=^(full|half)$}}" --cver=4.4
# engine-config -g CustomDeviceProperties
UserDefinedVMProperties:  version: 4.3
UserDefinedVMProperties:  version: 4.4
UserDefinedVMProperties : {type=interface;prop={speed=^([0-9]{1,5})$;duplex=^(full|half)$}} version: 4.4
# systemctl restart ovirt-engine.service
#!/usr/bin/python

import os
import sys

if os.environ.has_key('key1'):
	sys.stderr.write('key1 value was : %s\n' % os.environ['key1'])
else:
    sys.exit(0)
vdsm ALL=(ALL) NOPASSWD: /bin/chown
retcode = subprocess.call( ["/usr/bin/sudo", "/bin/chown", "root", "/my_file"] )
numaset=^(interleave|strict|preferred):[\^]?\d+(-\d+)?(,[\^]?\d+(-\d+)?)*$
#!/usr/bin/python

import os
import sys
import hooking
import traceback

'''
numa hook
=========
add numa support for domain xml:

<numatune>
    <memory mode="strict" nodeset="1-4,^3" />
</numatune>

memory=interleave|strict|preferred

numaset="1" (use one NUMA node)
numaset="1-4" (use 1-4 NUMA nodes)
numaset="^3" (don't use NUMA node 3)
numaset="1-4,^3,6" (or combinations)

syntax:
    numa=strict:1-4
'''

if os.environ.has_key('numa'):
    try:
        mode, nodeset = os.environ['numa'].split(':')

        domxml = hooking.read_domxml()

        domain = domxml.getElementsByTagName('domain')[0]
        numas = domxml.getElementsByTagName('numatune')

        if not len(numas) > 0:
            numatune = domxml.createElement('numatune')
            domain.appendChild(numatune)

            memory = domxml.createElement('memory')
            memory.setAttribute('mode', mode)
            memory.setAttribute('nodeset', nodeset)
            numatune.appendChild(memory)

            hooking.write_domxml(domxml)
        else:
            sys.stderr.write('numa: numa already exists in domain xml')
            sys.exit(2)
    except:
        sys.stderr.write('numa: [unexpected error]: %s\n' % traceback.format_exc())
        sys.exit(2)
# engine-config -s UserDefinedNetworkCustomProperties=ethtool_opts=.* --cver=4.4
# systemctl restart ovirt-engine.service
# dnf install vdsm-hook-ethtool-options
# engine-config -g UserDefinedNetworkCustomProperties
# engine-config -s UserDefinedNetworkCustomProperties='fcoe=^((enable|dcb|auto_vlan)=(yes|no),?)*$'
# systemctl restart ovirt-engine.service
# dnf install vdsm-hook-fcoe
// Access plug-in API using 'parent' due to this code being evaluated within the context of an iframe element.
// As 'parent.pluginApi' is subject to Same-Origin Policy, this will only work when WebAdmin HTML page and plug-in
// host page are served from same origin. WebAdmin HTML page and plug-in host page will always be on same origin
// when using UI plug-in infrastructure support to serve plug-in resource files.
var api = parent.pluginApi('MyPlugin');

// Runtime configuration object associated with the plug-in (or an empty object).
var config = api.configObject();

// Register event handler function(s) for later invocation by UI plug-in infrastructure.
api.register({
	    // UiInit event handler function.
		UiInit: function() {
				// Handle UiInit event.
					window.alert('Favorite music band is ' + config.band);
					    }
});

// Notify UI plug-in infrastructure to proceed with plug-in initialization.
api.ready();
{
    "name": "HelloWorld",
    "url": "/ovirt-engine/webadmin/plugin/HelloWorld/start.html",
    "resourcePath": "hello-files"
}
<!DOCTYPE html><html><head>
<script>
    var api = parent.pluginApi('HelloWorld');
    api.register({
	UiInit: function() { window.alert('Hello world'); }
    });
    api.ready();
</script>
</head><body></body></html>
# fips-mode-setup --check
FIPS mode is enabled.
# fips-mode-setup --check
FIPS mode is enabled.
# cp -p /etc/pki/ovirt-engine/keys/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12.bck
# cp /tmp/apache.p12 /etc/pki/ovirt-engine/keys/apache.p12
# openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nocerts -nodes > /tmp/apache.key
# openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nokeys > /tmp/apache.cer
# hosted-engine --set-maintenance --mode=global
# cp /tmp/3rd-party-ca-cert.pem /etc/pki/ca-trust/source/anchors
# update-ca-trust
# rm /etc/pki/ovirt-engine/apache-ca.pem
# cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem
# cp /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass.bck
# cp /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/certs/apache.cer.bck
# cp /tmp/apache.key /etc/pki/ovirt-engine/keys/apache.key.nopass
# chown root:ovirt  /etc/pki/ovirt-engine/keys/apache.key.nopass
# chmod 640 /etc/pki/ovirt-engine/keys/apache.key.nopass
# cp /tmp/apache.cer /etc/pki/ovirt-engine/certs/apache.cer
# chown root:ovirt /etc/pki/ovirt-engine/certs/apache.cer
# chmod 644 /etc/pki/ovirt-engine/certs/apache.cer
# systemctl restart httpd.service
ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD=""
SSL_CERTIFICATE=/etc/pki/ovirt-engine/certs/apache.cer
SSL_KEY=/etc/pki/ovirt-engine/keys/apache.key.nopass
# systemctl restart ovirt-websocket-proxy.service
# mkdir -p /etc/ovirt-engine-backup/engine-backup-config.d
BACKUP_PATHS="${BACKUP_PATHS}
/etc/ovirt-engine-backup"
cp -f /etc/pki/ovirt-engine/apache-ca.pem \
  /etc/pki/ca-trust/source/anchors/3rd-party-ca-cert.pem
update-ca-trust
# systemctl restart ovirt-provider-ovn.service
# systemctl restart ovirt-imageio.service
# systemctl restart ovirt-engine.service
# hosted-engine --set-maintenance --mode=none
$ keytool -importcert -noprompt -trustcacerts -alias myrootca -file /tmp/myrootca.pem -keystore /etc/ovirt-engine/aaa/myrootca.jks -storepass password
# Create keystore, import certificate chain and uncomment
pool.default.ssl.startTLS = true
pool.default.ssl.truststore.file = ${local:_basedir}/myrootca.jks
pool.default.ssl.truststore.password = password
# Create keystore, import certificate chain and uncomment
pool.default.serverset.single.port = 636
pool.default.ssl.enable = true
pool.default.ssl.truststore.file = ${local:_basedir}/myrootca.jks
pool.default.ssl.truststore.password = password
# ssh root@rhvm
# cd /usr/share/ovirt-engine/ansible-runner-service-project/project/
# ansible-playbook --ask-pass --inventory=<hostname> ovirt-vnc-sasl.yml <1>
Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.  Please add this host’s fingerprint to your known_hosts file to manage this host.
#host_key_checking = False
export ANSIBLE_HOST_KEY_CHECKING=False
$ mkdir ~/.pki/CA
$ curl -k -o ~/.pki/CA/cacert-<today’s date>.pem '\https://<engine_address>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA'
$ sudo dnf install cyrus-sasl-scram
# dnf install squid
http_access deny CONNECT !SSL_ports
http_access deny CONNECT !Safe_ports
# systemctl enable squid.service --now
# firewall-cmd --permanent --add-service=squid
# firewall-cmd --reload
# firewall-cmd --list-services
ssh dhcpv6-client squid
# engine-config -s SpiceProxyDefault=someProxy
# systemctl restart ovirt-engine.service
protocol://[host]:[port]
$ ssh root@[IP of Manager]
# engine-config -s SpiceProxyDefault=""
# systemctl restart ovirt-engine.service
openssl x509 -in /etc/pki/ovirt-engine/ca.pem -noout -text | grep DirName
subject= /C=US/O=Example Inc./CN=engine.example.com.81108
/C=US/O=Example Inc./CN=proxy.example.com
# openssl req -newkey rsa:2048 -subj '/C=US/O=Example Inc./CN=proxy.example.com' -nodes -keyout proxy.key -out proxy.req
# scp proxy.req engine.example.com:/etc/pki/ovirt-engine/requests/.
# /usr/share/ovirt-engine/bin/pki-enroll-request.sh --name=proxy --days=3650 --subject='/C=US/O=Example Inc./CN=proxy.example.com'
# scp engine.example.com:/etc/pki/ovirt-engine/certs/proxy.cer .
# ls -l proxy.key proxy.cer
# dnf install squid
# cp proxy.key proxy.cer /etc/squid/.
# chgrp squid /etc/squid/proxy.*
# chmod 640 /etc/squid/proxy.*
# scp engine.example.com:/etc/pki/ovirt-engine/ca.pem /etc/squid/.
# chgrp squid /etc/squid/ca.pem
# chmod 640 /etc/squid/ca.pem
# dnf install policycoreutils-python
# semanage port -m -p tcp -t http_cache_port_t 443
https_port 443 key=/etc/squid/proxy.key cert=/etc/squid/proxy.cer ssl-bump defaultsite=engine.example.com
cache_peer engine.example.com parent 443 0 no-query originserver ssl sslcafile=/etc/squid/ca.pem name=engine login=PASSTHRU
cache_peer_access engine allow all
ssl_bump allow all
http_access allow all
# systemctl restart squid.service

Role	권한	참고
UserRole	가상 시스템 및 풀에 액세스하고 사용할 수 있음.	VM 포털에 로그인할 수 있음, 할당된 가상 시스템 및 풀을 사용하며, 가상 시스템 상태 및 세부 정보를 확인합니다.
PowerUserRole	가상 시스템과 템플릿을 생성하고 관리할 수 있습니다.	Configure (구성) 창이 있거나 특정 데이터 센터 또는 클러스터에 대해 전체 환경의 사용자에게 이 역할을 적용합니다. 예를 들어 PowerUserRole이 데이터 센터에 적용된 경우 PowerUser는 데이터 센터에서 가상 시스템과 템플릿을 생성할 수 있습니다.
UserVmManager	가상 시스템의 시스템 관리자.	가상 시스템을 관리하고 스냅샷을 만들고 사용할 수 있습니다. VM 포털에서 가상 시스템을 생성하는 사용자에게는 시스템의 UserVmManager 역할이 자동으로 할당됩니다.

Role	권한	참고
UserTemplateBasedVm	템플릿만 사용하는 제한된 권한.	템플릿을 사용하여 가상 시스템을 생성할 수 있음.
DiskOperator	가상 디스크 사용자.	가상 디스크를 사용, 보기 및 편집할 수 있습니다. 가상 디스크가 연결된 가상 시스템을 사용하는 권한을 상속합니다.
VmCreator	VM 포털에서 가상 시스템을 생성할 수 있음.	이 역할은 특정 가상 시스템에 적용되지 않습니다. Configure (구성) 창이 있는 전체 환경의 사용자에게 이 역할을 적용합니다. 또는 특정 데이터 센터 또는 클러스터에 이 역할을 적용합니다. 이 역할을 클러스터에 적용하는 경우 전체 데이터 센터 또는 특정 스토리지 도메인에 DiskCreator 역할을 적용해야 합니다.
TemplateCreator	할당된 리소스 내에서 가상 시스템 템플릿을 생성, 편집, 관리 및 제거할 수 있습니다.	이 역할은 특정 템플릿에 적용되지 않습니다. Configure (구성) 창이 있는 전체 환경의 사용자에게 이 역할을 적용합니다. 또는 특정 데이터 센터, 클러스터 또는 스토리지 도메인에 이 역할을 적용합니다.
DiskCreator	할당된 클러스터 또는 데이터 센터 내에서 가상 디스크를 생성, 편집, 관리 및 제거할 수 있습니다.	이 역할은 특정 가상 디스크에 적용되지 않습니다. Configure (구성) 창이 있는 전체 환경의 사용자에게 이 역할을 적용합니다. 또는 특정 데이터 센터 또는 스토리지 도메인에 이 역할을 적용합니다.
TemplateOwner	템플릿을 편집하고 삭제하고, 템플릿에 대한 사용자 권한을 할당 및 관리할 수 있습니다.	이 역할은 템플릿을 생성하는 사용자에게 자동으로 할당됩니다. 템플릿에 대한 TemplateOwner 권한이 없는 다른 사용자는 템플릿을 보거나 사용할 수 없습니다.
VnicProfileUser	가상 시스템 및 템플릿용 논리적 네트워크 및 네트워크 인터페이스 사용자.	특정 논리적 네트워크에서 네트워크 인터페이스를 연결하거나 연결 해제할 수 있습니다.

Role	권한	참고
수퍼유저	Red Hat Virtualization 환경의 시스템 관리자.	에는 모든 오브젝트와 수준에 대한 전체 권한이 있으며, 모든 데이터 센터에서 모든 오브젝트를 관리할 수 있습니다.
ClusterAdmin	클러스터 관리자.	특정 클러스터 아래의 모든 오브젝트에 대한 관리 권한이 있습니다.
DataCenterAdmin	데이터 센터 관리자.	특정 데이터 센터 아래의 모든 오브젝트에 대한 관리 권한을 보유합니다. 단, 스토리지는 제외입니다.

Role	권한	참고
TemplateAdmin	가상 머신 템플릿 관리자.	템플릿의 스토리지 도메인과 네트워크 세부 정보를 생성, 삭제 및 구성하고 도메인 간에 템플릿을 이동할 수 있습니다.
StorageAdmin	스토리지 관리자.	할당된 스토리지 도메인을 생성, 삭제, 구성 및 관리할 수 있습니다.
HostAdmin	호스트 관리자.	특정 호스트를 연결, 제거, 구성 및 관리할 수 있습니다.
NetworkAdmin	네트워크 관리자.	특정 데이터 센터 또는 클러스터의 네트워크를 구성하고 관리할 수 있습니다. 데이터 센터 또는 클러스터의 네트워크 관리자는 클러스터 내의 가상 풀에 대한 네트워크 권한을 상속받습니다.
VmPoolAdmin	가상 풀의 시스템 관리자.	가상 풀을 생성, 삭제 및 구성하고, 가상 풀 사용자를 할당 및 제거하고, 풀의 가상 시스템에서 기본 작업을 수행할 수 있습니다.
GlusterAdmin	Gluster 스토리지 관리자.	Gluster 스토리지 볼륨을 생성, 삭제, 구성 및 관리할 수 있습니다.
VmImporterExporter	가상 시스템의 관리자 가져오기 및 내보내기.	가상 시스템을 가져오고 내보낼 수 있습니다. 다른 사용자가 내보낸 모든 가상 시스템과 템플릿을 볼 수 있습니다.

Role	권한	참고
DataCenterAdmin	데이터 센터 관리자	클러스터, 호스트, 템플릿 및 가상 시스템을 포함한 스토리지를 제외하고 특정 데이터 센터 내의 모든 실제 및 가상 리소스를 사용, 생성, 삭제, 관리할 수 있습니다.
NetworkAdmin	네트워크 관리자	특정 데이터 센터의 네트워크를 구성하고 관리할 수 있습니다. 데이터 센터의 네트워크 관리자는 데이터 센터 내의 가상 시스템에 대한 네트워크 권한을 상속받습니다.

필드 이름	설명
이름	스케줄링 정책의 이름입니다. Red Hat Virtualization Manager의 스케줄링 정책을 참조하는 데 사용되는 이름입니다.
설명	스케줄링 정책에 대한 설명입니다. 이 필드는 권장되지만 필수는 아닙니다.
필터 모듈	클러스터의 가상 시스템을 실행할 수 있는 호스트를 제어하는 필터 집합입니다. 필터를 활성화하면 아래에 설명된 대로 해당 필터에서 지정한 조건을 충족하지 않는 호스트를 필터링합니다. `ClusterInMaintenance`: 고가용성에 대해 구성되지 않은 호스트에서 시작하는 가상 시스템은 호스트를 필터링합니다. `CpuPinning`: CPU 고정 정의를 충족하지 않는 호스트입니다. `마이그레이션`: 동일한 호스트로 마이그레이션하는 것을 방지합니다. `CPUOverloaded`: CpuOverCommitDurationMinutes에서 정의한 간격에 대해 정의된 HighUtilization 임계값을 초과하는 CPU 사용량이 있는 호스트입니다. `PinToHost`: 가상 시스템이 고정된 호스트 이외의 호스트입니다. `CPU 레벨`: 가상 시스템의 CPU 토폴로지를 충족하지 않는 호스트입니다. `VmAffinityGroups`: 가상 시스템에 대해 정의된 선호도 규칙을 충족하지 않는 호스트입니다. `NUMA`: 리소스 측면에서 가상 머신 vNUMA 노드를 수용할 수 있는 NUMA 노드가 없는 호스트입니다. `InClusterUpgrade`: 가상 시스템이 현재 실행되는 호스트보다 이전 버전의 운영 체제를 실행 중인 호스트입니다. `MDevice`: 필수 중재 장치를 제공하지 않는 호스트(mDev). `메모리`: 가상 시스템을 실행하는 데 메모리가 충분하지 않은 호스트입니다. `CPU`: 가상 시스템에 할당된 수보다 CPU 수가 적은 호스트입니다. `HostedEnginesSpares`: 지정된 수의 자체 호스팅 엔진 노드에 있는 Manager 가상 시스템의 공간을 예약합니다. `스왑`: 임계값 내에서 스왑하지 않는 호스트입니다. `VM 리스를 준비합니다`: 스토리지 리스를 사용하여 구성된 가상 시스템을 지원하지 않는 호스트. `VmToHostsAffinityGroups`: 선호도 그룹의 멤버인 가상 시스템에 지정된 조건을 충족하지 않는 호스트 그룹입니다. 예를 들어 선호도 그룹의 해당 가상 시스템은 그룹의 호스트 중 하나 또는 그룹에서 제외된 별도의 호스트에서 실행해야 합니다. `HostDevice`: 가상 시스템에 필요한 호스트 장치를 지원하지 않는 호스트입니다. `HA`: 셀프 호스트 엔진 환경에서 Manager 가상 시스템이 양의 고가용성 점수가 있는 호스트에서만 실행되도록 강제 적용합니다. `에뮬레이트된 머신`: 에뮬레이트된 시스템 지원이 없는 호스트. `HugePages`: 가상 시스템의 메모리에 필요한 Huge Pages 수를 충족하지 않는 호스트입니다. `Migration-Tsc-Frequency`: 현재 가상 시스템을 실행 중인 호스트와 TSC 빈도가 동일한 가상 시스템이 없는 호스트입니다. `네트워크`: 가상 시스템의 네트워크 인터페이스 컨트롤러에 필요한 네트워크가 설치되어 있지 않거나 클러스터의 디스플레이 네트워크가 설치되지 않은 호스트입니다. `레이블`: 필수 선호도 레이블이 없는 호스트입니다. `compatibility-Version`: 올바른 클러스터 호환성 버전 지원이 없는 호스트.
weights 모듈	가상 시스템이 실행할 수 있는 클러스터의 호스트를 결정할 때 고려하는 요인의 상대 우선 순위를 제어하는 가중치 집합입니다. `VmAffinityGroups`: 가상 시스템에 정의된 선호도 그룹에 따라 호스트를 가중치화합니다. 이 weight 모듈은 해당 선호도 그룹의 매개 변수에 따라 선호도 그룹의 가상 시스템을 동일한 호스트 또는 별도의 호스트에서 실행할 가능성을 결정합니다. `InClusterUpgrade`: 운영 체제 버전에 따라 호스트 가중치. 가중치는 가상 시스템이 현재 실행 중인 호스트와 동일한 운영 체제가 있는 호스트보다 이전 운영 체제가 있는 호스트보다 더 많은 호스트를 사용할 수 있습니다. 이렇게 하면 이후 운영 체제가 있는 호스트에 우선순위가 항상 부여됩니다. `OptimalForCpuEvenDistribution`: CPU 사용량에 따라 호스트를 가중치로 사용하여 CPU 사용량이 낮은 호스트에 우선 순위를 부여합니다. `고성능 VM의 CPU`: VM과 동일한 수의 소켓, 코어 및 스레드가 있는 호스트를 선호합니다. `HA`: 고가용성 점수에 따라 호스트의 가중치를 지정합니다. `OptimalForCpuPowerSaving`: CPU 사용량에 따라 호스트를 가중치로 사용하여 CPU 사용량이 높은 호스트에 우선 순위를 제공합니다. `OptimalForMemoryPowerSaving`: 메모리 사용량에 따라 호스트를 가중치로 사용하여 사용 가능한 메모리가 낮은 호스트에 우선 순위를 제공합니다. `CPU 및 NUMA 고정 호환성`: 호환성 고정에 따른 가중치 호스트. 가상 시스템에 vNUMA와 고정이 정의되어 있는 경우 이 weight 모듈은 CPU 고정이 vNUMA 고정과 충돌하지 않는 호스트를 선호합니다. `VmToHostsAffinityGroups`: 가상 시스템에 정의된 선호도 그룹에 따라 호스트를 가중치화합니다. 이 weight 모듈은 선호도 그룹의 가상 시스템을 그룹의 호스트 중 하나 또는 그룹에서 제외된 별도의 호스트에서 실행할 가능성을 결정합니다. `OptimalForEvenGuestDistribution`: 해당 호스트에서 실행되는 가상 시스템의 수에 따라 호스트를 가중치화합니다. `OptimalForHaReservation`: 고가용성 점수에 따라 호스트의 가중치를 지정합니다. `OptimalForMemoryEvenDistribution`: 메모리 사용량에 따라 호스트를 가중치로 사용하여 사용 가능한 메모리가 높은 호스트에 우선 순위를 제공합니다. `단일 호스트 NUMA 노드에 VM 적합`: 가상 머신이 단일 NUMA 노드에 적합한지 여부에 따라 호스트를 가중합니다. 가상 시스템에 vNUMA가 정의되지 않은 경우 이 weight 모듈은 가상 시스템을 하나의 물리적 NUMA에 적합할 수 있는 호스트를 선호합니다. `PreferredHosts`: 가상 시스템을 설정하는 동안 선호되는 호스트에는 우선 순위가 있습니다.
로드 밸런서	이 드롭다운 메뉴에서 적용할 부하 분산 모듈을 선택할 수 있습니다. 부하 분산 모듈은 사용량이 낮은 호스트에서 가상 시스템을 마이그레이션하는 데 사용되는 논리를 판별합니다.
속성	이 드롭다운 메뉴를 사용하면 부하 분산 모듈의 속성을 추가하거나 제거할 수 있으며 스케줄링 정책에 대한 부하 분산 모듈을 선택한 경우에만 사용할 수 있습니다. 속성은 기본적으로 정의되지 않으며 사용 가능한 속성은 선택한 부하 분산 모듈에 따라 다릅니다. + 및 - 버튼을 사용하여 부하 분산 모듈에 추가 속성을 추가하거나 제거합니다.

이름	메모리	vCPU
작음	512MB	1
소	2GB	1
중간	4GB	2
대	8GB	2
XLarge	16GB	4

아이콘	상태
	Red Hat Virtualization에 추가된 리소스가 없습니다.
	경고 상태의 리소스 수를 표시합니다. 아이콘을 클릭하면 경고 상태로 해당 리소스로 제한된 검색이 있는 적절한 페이지로 이동합니다. 검색은 리소스마다 다르게 제한됩니다. 데이터 센터: 검색은 작동하거나 응답하지 않는 데이터 센터로 제한됩니다. Gluster 볼륨: 검색은 전원을 켜거나, 일시 중지됨, 마이그레이션, 대기, 일시 중단 또는 전원이 꺼지는 Gluster 볼륨으로 제한됩니다. 호스트: 검색은 할당되지 않았거나 유지 관리 모드, 설치, 재부팅, 유지 관리 준비, 보류 중인 승인 또는 연결을 위한 호스트로 제한됩니다. 스토리지 도메인: 검색은 초기화되지 않았거나, 연결되지 않음, 비활성, 유지 관리 모드에서 준비, 유지 관리, 분리 또는 활성화를 준비하는 스토리지 도메인으로 제한됩니다. 가상 머신: 이 검색은 전원 켜기, 일시 중지, 마이그레이션, 대기, 일시 중단 또는 전원이 꺼지는 가상 머신으로 제한됩니다. 이벤트: 검색은 심각도가 warning인 이벤트로 제한됩니다.
	상태가 up인 리소스 수를 표시합니다. 아이콘을 클릭하면 작동 중인 리소스로 제한된 검색으로 적절한 페이지로 이동합니다.
	상태가 down인 리소스 수를 표시합니다. 아이콘을 클릭하면 down 상태로 리소스로 제한된 검색을 사용하여 적절한 페이지로 이동합니다. 검색은 리소스마다 다르게 제한됩니다. 데이터 센터: 검색은 초기화되지 않았거나 유지 관리 모드 또는 다운 상태인 데이터 센터로 제한됩니다. Gluster 볼륨: 검색은 분리되거나 비활성 볼륨으로 제한됩니다. 호스트: 검색은 응답하지 않고 오류가 있으며 설치 오류, 비작동, 초기화 또는 다운이 있는 호스트로 제한됩니다. 스토리지 도메인: 검색은 분리되거나 비활성화된 스토리지 도메인으로 제한됩니다. 가상 머신: 검색은 다운되거나 응답하지 않거나 재부팅되지 않는 가상 시스템으로 제한됩니다.
images:images/Dashboard_Alert.png[title="Alert icon"]	경고 상태가 있는 이벤트 수를 표시합니다. 아이콘을 클릭하면 심각도가 alert인 이벤트로 제한된 검색이 있는 이벤트로 이동합니다.
images:images/Dashboard_Error.png[title="Error icon"]	오류 상태의 이벤트 수를 표시합니다. 아이콘을 클릭하면 심각도가 error인 이벤트로 제한된 검색이 있는 Events 로 이동합니다.

예제	결과
호스트: VMs.status = 페이지 위로 2	작동 중인 가상 시스템을 실행하는 모든 호스트 목록의 2페이지를 표시합니다.
VM: domain = qa.company.com	지정된 도메인에서 실행 중인 모든 가상 시스템 목록을 표시합니다.
VM: users.name =	사용자 이름에 속하는 모든 가상 시스템 목록을 표시합니다.
이벤트: 심각도 > 일반 정렬	심각도가 Normal 이상인 모든 이벤트 목록을 표시하고 시간별로 정렬됩니다.

Language and Page Formatting Options

관리 가이드

Red Hat Virtualization의 관리 작업

Red Hat Virtualization Documentation Team

1장. Red Hat Virtualization 환경 관리 및 유지 관리

1.1. 글로벌 설정

1.1.1. 역할

1.1.1.1. 새 역할 생성

1.1.1.2. 역할 편집 또는 복사

1.1.1.3. 사용자 역할 및 권한 부여 예

1.1.2. 시스템 권한

1.1.2.1. 사용자 속성

1.1.2.2. 사용자 및 관리자 역할

1.1.2.3. 사용자 역할 설명

1.1.2.4. 설명된 관리자 역할

1.1.2.5. 리소스에 관리자 또는 사용자 역할 할당

1.1.2.6. 리소스에서 관리자 또는 사용자 역할 제거

1.1.2.7. 데이터 센터의 시스템 권한 관리

1.1.2.8. 설명된 데이터 센터 관리자 역할

1.1.2.9. 클러스터의 시스템 권한 관리

1.1.2.10. 설명된 클러스터 관리자 역할

1.1.2.11. 네트워크의 시스템 권한 관리

1.1.2.12. 설명된 네트워크 관리자 및 사용자 역할

1.1.2.13. 호스트의 시스템 권한 관리

1.1.2.14. 설명된 호스트 관리자 역할

1.1.2.15. 스토리지 도메인의 시스템 권한 관리

1.1.2.16. 설명된 스토리지 관리자 역할

1.1.2.17. 가상 머신 풀의 시스템 권한 관리

1.1.2.18. 가상 머신 풀 관리자 역할 설명

1.1.2.19. 가상 디스크의 시스템 권한 관리

1.1.2.20. 가상 디스크 사용자 역할 설명

1.1.2.20.1. 레거시 SPICE 암호 설정

1.1.3. 예약 정책

1.1.3.1. 스케줄링 정책 생성

1.1.3.2. 새 스케줄링 정책의 설정 설명 및 스케줄링 정책 편집 창

1.1.4. 인스턴스 유형

1.1.4.1. 인스턴스 유형 생성

1.1.4.2. 인스턴스 유형 편집

1.1.4.3. 인스턴스 유형 제거

1.1.5. MAC 주소 풀

1.1.5.1. MAC 주소 풀 생성

1.1.5.2. MAC 주소 풀 편집

1.1.5.3. MAC 주소 풀 권한 편집

1.1.5.4. MAC 주소 풀 제거

1.2. 대시보드

1.2.1. 사전 요구 사항

1.2.2. 글로벌 인벤토리

1.2.3. 글로벌 사용률

1.2.3.1. 사용률 상위 리소스

1.2.4. 클러스터 사용률

1.2.4.1. CPU

1.2.4.2. 메모리

1.2.5. 스토리지 사용률

1.3. 검색

1.3.1. Red Hat Virtualization에서 검색 수행

1.3.2. 구문 및 예제 검색

1.3.3. 자동 완성 검색

1.3.4. 결과 검색 유형 옵션

1.3.5. 검색 기준

1.3.6. 검색: 다중 기준 및 와일드카드

1.3.7. 검색: 검색 순서 확인

1.3.8. 데이터 센터 검색

1.3.9. 클러스터 검색

1.3.10. 호스트 검색

1.3.11. 네트워크 검색

1.3.12. 스토리지 검색

1.3.13. 디스크 검색

1.3.14. 볼륨 검색

1.3.15. 가상 머신 검색

1.3.16. 풀 검색

1.3.17. 템플릿 검색

1.3.18. 사용자 검색

1.3.19. 이벤트 검색

1.4. 북마크

1.4.1. 북마크로 쿼리 문자열 저장

1.4.2. 북마크 편집

1.4.3. 북마크 삭제

1.5. 태그

1.5.1. 태그를 사용하여 Red Hat Virtualization과의 상호 작용 사용자 정의

1.5.2. 태그 생성